Microsoft has released critical security patches for its Office software, fixing a flaw in Excel that had been exploited by attackers for the past two months.

The bug fixes were released Tuesday in four software updates for Excel, Outlook, Office 2000 and Office's Web components. Microsoft rates all of the updates as critical, meaning that an attacker could theoretically exploit these flaws in order to hack into a victim's computer.

In total, 12 vulnerabilities are fixed in the four updates.

Typically Microsoft includes bug fixes for Windows or Internet Explorer in its monthly security updates, and security experts said Tuesday that this is the first time they could remember Microsoft focusing the patches exclusively on Office.

It's a sign of the times, according to Paul Zimski, senior director of market strategy with Lumension.

Between 2006 and 2007 the number of attacks targeting Office software doubled, he said. "Malicious entities are looking toward Office as a vector for delivering malicious code," he said. "You can't really mitigate against Office: organizations can't block Office attachments and Office documents are generally trusted by users."

Although all of Tuesday's updates are critical, system administrators will want to pay special attention to MS08-014, because it fixes a publicly disclosed flaw that hackers have been exploiting for several months now. "This is the long awaited patch for the Excel zero day issue first reported in mid-January 2008," said Eric Schultze, chief security architect with Shavlik Technologies, via instant message. "Angst-ridden computer users can now sleep easy knowing that they can now open malicious Excel documents without fear of being hacked."

"Patch this one as soon as possible if you visit illicit Web sites or open malformed Excel documents on a regular basis," he added.

This previously disclosed bug affects users of Excel 2000, 2002 and 2003, and Service Pack 2, although customers with Excel 2007 or Excel 2003, Service Pack 3 are not at risk, according to Microsoft.

Another update to watch is the MS08-015 patch, which contains a flaw that could be easily exploited by attackers. By tricking the victim into clicking on a specially crafted "mailto" Web link, an attacker could "install programs; view, change, or delete data; or create new accounts with full user right," Microsoft said in its security bulletin.

These types of bugs, called URI (Uniform Resource Identifier) handling flaws, have been increasingly studied by hackers and security researchers over the past year, and they have led to a number of effective Web-based attacks.